NetSight
IP …
high7.5

CVE-2016-2118

The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, w…

Impact

The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."

Affected products

VendorProductAffected versions
SambaSamba
from 3.6.0 before 4.2.10
from 4.3.0 before 4.3.7
from 4.4.0 before 4.4.1
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.10, 16.04
DebianDebian Linux
Versions 7.0, 8.0

Weakness classification

CWE-254

References